The triumvirate of automation, expressivity, and safety Chantal Keller October, 18 th 2016 The triumvirate ofautomation, expressivity, and safety Chantal Keller 1 / 18
Why so many provers? A wide range of applications, such as: deductive verification proofs of programs “mathematical” proofs formalizing metatheory induction/coinduction reasoning on/with computation . . . The triumvirate ofautomation, expressivity, and safety Chantal Keller 2 / 18
The triumvirate The triumvirate ofautomation, expressivity, and safety Chantal Keller 3 / 18
Interoperability: get the best of everything But: at what cost/effort? how agnostic can the systems be? portability? automation? The triumvirate ofautomation, expressivity, and safety Chantal Keller 4 / 18
Interoperability: get the best of everything But: at what cost/effort? how agnostic can the systems be? portability? automation? In this talk: three examples of interoperability between two systems A and B The triumvirate ofautomation, expressivity, and safety Chantal Keller 4 / 18
1. Autarkic approach system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 5 / 18
1. Autarkic approach system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 5 / 18
1. Autarkic approach goal system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 5 / 18
1. Autarkic approach goal system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 5 / 18
1. Autarkic approach goal system B system A Ex: Ergo (A = Coq; B = subset of Alt-Ergo) The triumvirate ofautomation, expressivity, and safety Chantal Keller 5 / 18
Advantages and limitations + shared representation of formulas + correctness established once and for all + formal correctness of the algorithms - really hard to prove - really hard to maintain or improve (fixes the implementation) - not always possible The triumvirate ofautomation, expressivity, and safety Chantal Keller 6 / 18
Our criteria: at what cost/effort? statements? none proofs? huge how agnostic can the systems be? not at all portability? none automation? medium The triumvirate ofautomation, expressivity, and safety Chantal Keller 7 / 18
2. Skeptical approach system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach goal system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach goal proof system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach goal proof system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach goal certificate preprocessor proof system B system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
2. Skeptical approach goal (correctness) certificate preprocessor proof system B checker system A The triumvirate ofautomation, expressivity, and safety Chantal Keller 8 / 18
Examples Tool System A System B metis Isabelle/HOL, HOL4, . . . metis sledgehammer Isabelle/HOL Z3, CVC4, vampire SMTCoq Coq ZChaff, veriT, CVC4 HOL Light ↔ Coq Coq HOL Light The triumvirate ofautomation, expressivity, and safety Chantal Keller 9 / 18
Advantages and limitations + correctness easier to establish + System B may evolve independently + pre-processing ⇒ efficiency and various provers + caching - no shared representation of formulas - if the certificate is false? - System B needs instrumentation The triumvirate ofautomation, expressivity, and safety Chantal Keller 10 / 18
Our criteria: at what cost/effort? statements? from small to huge proofs? small how agnostic can the systems be? only certificates portability? great automation? medium to good The triumvirate ofautomation, expressivity, and safety Chantal Keller 11 / 18
Standards for certificates? Propositions: LFSC veriT/SMTCoq TPTP Open Theory . . . Encodings between first-order formats not that hard The triumvirate ofautomation, expressivity, and safety Chantal Keller 12 / 18
3. A priori approaches Built-in interoperability: decide in advance the interoperability you want with System B build System A around it The triumvirate ofautomation, expressivity, and safety Chantal Keller 13 / 18
Example: F* impure functional programming language rich type system: dependent and refined types (to express various properties on programs) type checking: designed to use the Z3 SMT solver Curry-Howard: programs are proofs The triumvirate ofautomation, expressivity, and safety Chantal Keller 14 / 18
Example: F* impure functional programming language rich type system: dependent and refined types (to express various properties on programs) type checking: designed to use the Z3 SMT solver Curry-Howard: programs are proofs module Induction val u : nat -> Tot nat let rec u n = if n = 0 then 0 else u (n-1) The triumvirate ofautomation, expressivity, and safety Chantal Keller 14 / 18
Example: F* impure functional programming language rich type system: dependent and refined types (to express various properties on programs) type checking: designed to use the Z3 SMT solver Curry-Howard: programs are proofs module Induction val u : nat -> Tot nat let rec u n = if n = 0 then 0 else u (n-1) val induction : n:nat -> Lemma (ensures (u n = 0)) let rec induction n = if n = 0 then () else induction (n-1) The triumvirate ofautomation, expressivity, and safety Chantal Keller 14 / 18
Example: Why3 The triumvirate ofautomation, expressivity, and safety Chantal Keller 15 / 18
Our criteria: at what cost/effort? statements? from small to huge proofs? from small to huge how agnostic can the systems be? good portability? bad automation? really good The triumvirate ofautomation, expressivity, and safety Chantal Keller 16 / 18
Summary Criterion Autarkic Skeptical A priori effort (statements) ++ – - effort (proofs) – ++ - agnostic – ++ + portability – ++ - automation + + ++ The triumvirate ofautomation, expressivity, and safety Chantal Keller 17 / 18
Take-away The lessons for new systems: interoperability is hard! think from the very beginning that people may want to use your system differently certificates (possibly in a standard), API, . . . The triumvirate ofautomation, expressivity, and safety Chantal Keller 18 / 18
Recommend
More recommend
